openssh/packet.c

   1 /* $OpenBSD: packet.c,v 1.160 2009/02/13 11:50:21 markus Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * This file contains code implementing the packet protocol and communication
   7  * with the other side.  This same code is used both on client and server side.
   8  *
   9  * As far as I am concerned, the code I have written for this software
  10  * can be used freely for any purpose.  Any derived versions of this
  11  * software must be clearly marked as such, and if the derived work is
  12  * incompatible with the protocol description in the RFC file, it must be
  13  * called by a name other than "ssh" or "Secure Shell".
  14  *
  15  *
  16  * SSH2 packet format added by Markus Friedl.
  17  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms, with or without
  20  * modification, are permitted provided that the following conditions
  21  * are met:
  22  * 1. Redistributions of source code must retain the above copyright
  23  *    notice, this list of conditions and the following disclaimer.
  24  * 2. Redistributions in binary form must reproduce the above copyright
  25  *    notice, this list of conditions and the following disclaimer in the
  26  *    documentation and/or other materials provided with the distribution.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  29  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  30  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  31  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  32  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  33  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  34  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  35  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  36  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  37  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  38  */
  39
  40 #include "includes.h"
  41
  42 #include <sys/types.h>
  43 #include "openbsd-compat/sys-queue.h"
  44 #include <sys/param.h>
  45 #include <sys/socket.h>
  46 #ifdef HAVE_SYS_TIME_H
  47 # include <sys/time.h>
  48 #endif
  49
  50 #include <netinet/in.h>
  51 #include <netinet/ip.h>
  52 #include <arpa/inet.h>
  53
  54 #include <errno.h>
  55 #include <stdarg.h>
  56 #include <stdio.h>
  57 #include <stdlib.h>
  58 #include <string.h>
  59 #include <unistd.h>
  60 #include <signal.h>
  61
  62 #include "xmalloc.h"
  63 #include "buffer.h"
  64 #include "packet.h"
  65 #include "crc32.h"
  66 #include "compress.h"
  67 #include "deattack.h"
  68 #include "channels.h"
  69 #include "compat.h"
  70 #include "ssh1.h"
  71 #include "ssh2.h"
  72 #include "cipher.h"
  73 #include "key.h"
  74 #include "kex.h"
  75 #include "mac.h"
  76 #include "log.h"
  77 #include "canohost.h"
  78 #include "misc.h"
  79 #include "ssh.h"
  80
  81 #ifdef PACKET_DEBUG
  82 #define DBG(x) x
  83 #else
  84 #define DBG(x)
  85 #endif
  86
  87 #define PACKET_MAX_SIZE (256 * 1024)
  88
  89 /*
  90  * This variable contains the file descriptors used for communicating with
  91  * the other side.  connection_in is used for reading; connection_out for
  92  * writing.  These can be the same descriptor, in which case it is assumed to
  93  * be a socket.
  94  */
  95 static int connection_in = -1;
  96 static int connection_out = -1;
  97
  98 /* Protocol flags for the remote side. */
  99 static u_int remote_protocol_flags = 0;
 100
 101 /* Encryption context for receiving data.  This is only used for decryption. */
 102 static CipherContext receive_context;
 103
 104 /* Encryption context for sending data.  This is only used for encryption. */
 105 static CipherContext send_context;
 106
 107 /* Buffer for raw input data from the socket. */
 108 Buffer input;
 109
 110 /* Buffer for raw output data going to the socket. */
 111 Buffer output;
 112
 113 /* Buffer for the partial outgoing packet being constructed. */
 114 static Buffer outgoing_packet;
 115
 116 /* Buffer for the incoming packet currently being processed. */
 117 static Buffer incoming_packet;
 118
 119 /* Scratch buffer for packet compression/decompression. */
 120 static Buffer compression_buffer;
 121 static int compression_buffer_ready = 0;
 122
 123 /* Flag indicating whether packet compression/decompression is enabled. */
 124 static int packet_compression = 0;
 125
 126 /* default maximum packet size */
 127 u_int max_packet_size = 32768;
 128
 129 /* Flag indicating whether this module has been initialized. */
 130 static int initialized = 0;
 131
 132 /* Set to true if the connection is interactive. */
 133 static int interactive_mode = 0;
 134
 135 /* Set to true if we are the server side. */
 136 static int server_side = 0;
 137
 138 /* Set to true if we are authenticated. */
 139 static int after_authentication = 0;
 140
 141 int keep_alive_timeouts = 0;
 142
 143 /* Set to the maximum time that we will wait to send or receive a packet */
 144 static int packet_timeout_ms = -1;
 145
 146 /* Session key information for Encryption and MAC */
 147 Newkeys *newkeys[MODE_MAX];
 148 static struct packet_state {
 149         u_int32_t seqnr;
 150         u_int32_t packets;
 151         u_int64_t blocks;
 152         u_int64_t bytes;
 153 } p_read, p_send;
 154
 155 static u_int64_t max_blocks_in, max_blocks_out;
 156 static u_int32_t rekey_limit;
 157
 158 /* Session key for protocol v1 */
 159 static u_char ssh1_key[SSH_SESSION_KEY_LENGTH];
 160 static u_int ssh1_keylen;
 161
 162 /* roundup current message to extra_pad bytes */
 163 static u_char extra_pad = 0;
 164
 165 /* XXX discard incoming data after MAC error */
 166 static u_int packet_discard = 0;
 167 static Mac *packet_discard_mac = NULL;
 168
 169 struct packet {
 170         TAILQ_ENTRY(packet) next;
 171         u_char type;
 172         Buffer payload;
 173 };
 174 TAILQ_HEAD(, packet) outgoing;
 175
 176 /*
 177  * Sets the descriptors used for communication.  Disables encryption until
 178  * packet_set_encryption_key is called.
 179  */
 180 void
 181 packet_set_connection(int fd_in, int fd_out)
 182 {
 183         Cipher *none = cipher_by_name("none");
 184
 185         if (none == NULL)
 186                 fatal("packet_set_connection: cannot load cipher 'none'");
 187         connection_in = fd_in;
 188         connection_out = fd_out;
 189         cipher_init(&send_context, none, (const u_char *)"",
 190             0, NULL, 0, CIPHER_ENCRYPT);
 191         cipher_init(&receive_context, none, (const u_char *)"",
 192             0, NULL, 0, CIPHER_DECRYPT);
 193         newkeys[MODE_IN] = newkeys[MODE_OUT] = NULL;
 194         if (!initialized) {
 195                 initialized = 1;
 196                 buffer_init(&input);
 197                 buffer_init(&output);
 198                 buffer_init(&outgoing_packet);
 199                 buffer_init(&incoming_packet);
 200                 TAILQ_INIT(&outgoing);
 201                 p_send.packets = p_read.packets = 0;
 202         }
 203 }
 204
 205 void
 206 packet_set_timeout(int timeout, int count)
 207 {
 208         if (timeout == 0 || count == 0) {
 209                 packet_timeout_ms = -1;
 210                 return;
 211         }
 212         if ((INT_MAX / 1000) / count < timeout)
 213                 packet_timeout_ms = INT_MAX;
 214         else
 215                 packet_timeout_ms = timeout * count * 1000;
 216 }
 217
 218 static void
 219 packet_stop_discard(void)
 220 {
 221         if (packet_discard_mac) {
 222                 char buf[1024];
 223
 224                 memset(buf, 'a', sizeof(buf));
 225                 while (buffer_len(&incoming_packet) < PACKET_MAX_SIZE)
 226                         buffer_append(&incoming_packet, buf, sizeof(buf));
 227                 (void) mac_compute(packet_discard_mac,
 228                     p_read.seqnr,
 229                     buffer_ptr(&incoming_packet),
 230                     PACKET_MAX_SIZE);
 231         }
 232         logit("Finished discarding for %.200s", get_remote_ipaddr());
 233         cleanup_exit(255);
 234 }
 235
 236 static void
 237 packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
 238 {
 239         if (enc == NULL || !cipher_is_cbc(enc->cipher))
 240                 packet_disconnect("Packet corrupt");
 241         if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
 242                 packet_discard_mac = mac;
 243         if (buffer_len(&input) >= discard)
 244                 packet_stop_discard();
 245         packet_discard = discard - buffer_len(&input);
 246 }
 247
 248 /* Returns 1 if remote host is connected via socket, 0 if not. */
 249
 250 int
 251 packet_connection_is_on_socket(void)
 252 {
 253         struct sockaddr_storage from, to;
 254         socklen_t fromlen, tolen;
 255
 256         /* filedescriptors in and out are the same, so it's a socket */
 257         if (connection_in == connection_out)
 258                 return 1;
 259         fromlen = sizeof(from);
 260         memset(&from, 0, sizeof(from));
 261         if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
 262                 return 0;
 263         tolen = sizeof(to);
 264         memset(&to, 0, sizeof(to));
 265         if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
 266                 return 0;
 267         if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
 268                 return 0;
 269         if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
 270                 return 0;
 271         return 1;
 272 }
 273
 274 /*
 275  * Exports an IV from the CipherContext required to export the key
 276  * state back from the unprivileged child to the privileged parent
 277  * process.
 278  */
 279
 280 void
 281 packet_get_keyiv(int mode, u_char *iv, u_int len)
 282 {
 283         CipherContext *cc;
 284
 285         if (mode == MODE_OUT)
 286                 cc = &send_context;
 287         else
 288                 cc = &receive_context;
 289
 290         cipher_get_keyiv(cc, iv, len);
 291 }
 292
 293 int
 294 packet_get_keycontext(int mode, u_char *dat)
 295 {
 296         CipherContext *cc;
 297
 298         if (mode == MODE_OUT)
 299                 cc = &send_context;
 300         else
 301                 cc = &receive_context;
 302
 303         return (cipher_get_keycontext(cc, dat));
 304 }
 305
 306 void
 307 packet_set_keycontext(int mode, u_char *dat)
 308 {
 309         CipherContext *cc;
 310
 311         if (mode == MODE_OUT)
 312                 cc = &send_context;
 313         else
 314                 cc = &receive_context;
 315
 316         cipher_set_keycontext(cc, dat);
 317 }
 318
 319 int
 320 packet_get_keyiv_len(int mode)
 321 {
 322         CipherContext *cc;
 323
 324         if (mode == MODE_OUT)
 325                 cc = &send_context;
 326         else
 327                 cc = &receive_context;
 328
 329         return (cipher_get_keyiv_len(cc));
 330 }
 331
 332 void
 333 packet_set_iv(int mode, u_char *dat)
 334 {
 335         CipherContext *cc;
 336
 337         if (mode == MODE_OUT)
 338                 cc = &send_context;
 339         else
 340                 cc = &receive_context;
 341
 342         cipher_set_keyiv(cc, dat);
 343 }
 344
 345 int
 346 packet_get_ssh1_cipher(void)
 347 {
 348         return (cipher_get_number(receive_context.cipher));
 349 }
 350
 351 void
 352 packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packets,
 353     u_int64_t *bytes)
 354 {
 355         struct packet_state *state;
 356
 357         state = (mode == MODE_IN) ? &p_read : &p_send;
 358         if (seqnr)
 359                 *seqnr = state->seqnr;
 360         if (blocks)
 361                 *blocks = state->blocks;
 362         if (packets)
 363                 *packets = state->packets;
 364         if (bytes)
 365                 *bytes = state->bytes;
 366 }
 367
 368 void
 369 packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets,
 370     u_int64_t bytes)
 371 {
 372         struct packet_state *state;
 373
 374         state = (mode == MODE_IN) ? &p_read : &p_send;
 375         state->seqnr = seqnr;
 376         state->blocks = blocks;
 377         state->packets = packets;
 378         state->bytes = bytes;
 379 }
 380
 381 /* returns 1 if connection is via ipv4 */
 382
 383 int
 384 packet_connection_is_ipv4(void)
 385 {
 386         struct sockaddr_storage to;
 387         socklen_t tolen = sizeof(to);
 388
 389         memset(&to, 0, sizeof(to));
 390         if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
 391                 return 0;
 392         if (to.ss_family == AF_INET)
 393                 return 1;
 394 #ifdef IPV4_IN_IPV6
 395         if (to.ss_family == AF_INET6 &&
 396             IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
 397                 return 1;
 398 #endif
 399         return 0;
 400 }
 401
 402 /* Sets the connection into non-blocking mode. */
 403
 404 void
 405 packet_set_nonblocking(void)
 406 {
 407         /* Set the socket into non-blocking mode. */
 408         set_nonblock(connection_in);
 409
 410         if (connection_out != connection_in)
 411                 set_nonblock(connection_out);
 412 }
 413
 414 /* Returns the socket used for reading. */
 415
 416 int
 417 packet_get_connection_in(void)
 418 {
 419         return connection_in;
 420 }
 421
 422 /* Returns the descriptor used for writing. */
 423
 424 int
 425 packet_get_connection_out(void)
 426 {
 427         return connection_out;
 428 }
 429
 430 /* Closes the connection and clears and frees internal data structures. */
 431
 432 void
 433 packet_close(void)
 434 {
 435         if (!initialized)
 436                 return;
 437         initialized = 0;
 438         if (connection_in == connection_out) {
 439                 shutdown(connection_out, SHUT_RDWR);
 440                 close(connection_out);
 441         } else {
 442                 close(connection_in);
 443                 close(connection_out);
 444         }
 445         buffer_free(&input);
 446         buffer_free(&output);
 447         buffer_free(&outgoing_packet);
 448         buffer_free(&incoming_packet);
 449         if (compression_buffer_ready) {
 450                 buffer_free(&compression_buffer);
 451                 buffer_compress_uninit();
 452         }
 453         cipher_cleanup(&send_context);
 454         cipher_cleanup(&receive_context);
 455 }
 456
 457 /* Sets remote side protocol flags. */
 458
 459 void
 460 packet_set_protocol_flags(u_int protocol_flags)
 461 {
 462         remote_protocol_flags = protocol_flags;
 463 }
 464
 465 /* Returns the remote protocol flags set earlier by the above function. */
 466
 467 u_int
 468 packet_get_protocol_flags(void)
 469 {
 470         return remote_protocol_flags;
 471 }
 472
 473 /*
 474  * Starts packet compression from the next packet on in both directions.
 475  * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
 476  */
 477
 478 static void
 479 packet_init_compression(void)
 480 {
 481         if (compression_buffer_ready == 1)
 482                 return;
 483         compression_buffer_ready = 1;
 484         buffer_init(&compression_buffer);
 485 }
 486
 487 void
 488 packet_start_compression(int level)
 489 {
 490         if (packet_compression && !compat20)
 491                 fatal("Compression already enabled.");
 492         packet_compression = 1;
 493         packet_init_compression();
 494         buffer_compress_init_send(level);
 495         buffer_compress_init_recv();
 496 }
 497
 498 /*
 499  * Causes any further packets to be encrypted using the given key.  The same
 500  * key is used for both sending and reception.  However, both directions are
 501  * encrypted independently of each other.
 502  */
 503
 504 void
 505 packet_set_encryption_key(const u_char *key, u_int keylen,
 506     int number)
 507 {
 508         Cipher *cipher = cipher_by_number(number);
 509
 510         if (cipher == NULL)
 511                 fatal("packet_set_encryption_key: unknown cipher number %d", number);
 512         if (keylen < 20)
 513                 fatal("packet_set_encryption_key: keylen too small: %d", keylen);
 514         if (keylen > SSH_SESSION_KEY_LENGTH)
 515                 fatal("packet_set_encryption_key: keylen too big: %d", keylen);
 516         memcpy(ssh1_key, key, keylen);
 517         ssh1_keylen = keylen;
 518         cipher_init(&send_context, cipher, key, keylen, NULL, 0, CIPHER_ENCRYPT);
 519         cipher_init(&receive_context, cipher, key, keylen, NULL, 0, CIPHER_DECRYPT);
 520 }
 521
 522 u_int
 523 packet_get_encryption_key(u_char *key)
 524 {
 525         if (key == NULL)
 526                 return (ssh1_keylen);
 527         memcpy(key, ssh1_key, ssh1_keylen);
 528         return (ssh1_keylen);
 529 }
 530
 531 /* Start constructing a packet to send. */
 532 void
 533 packet_start(u_char type)
 534 {
 535         u_char buf[9];
 536         int len;
 537
 538         DBG(debug("packet_start[%d]", type));
 539         len = compat20 ? 6 : 9;
 540         memset(buf, 0, len - 1);
 541         buf[len - 1] = type;
 542         buffer_clear(&outgoing_packet);
 543         buffer_append(&outgoing_packet, buf, len);
 544 }
 545
 546 /* Append payload. */
 547 void
 548 packet_put_char(int value)
 549 {
 550         char ch = value;
 551
 552         buffer_append(&outgoing_packet, &ch, 1);
 553 }
 554
 555 void
 556 packet_put_int(u_int value)
 557 {
 558         buffer_put_int(&outgoing_packet, value);
 559 }
 560
 561 void
 562 packet_put_string(const void *buf, u_int len)
 563 {
 564         buffer_put_string(&outgoing_packet, buf, len);
 565 }
 566
 567 void
 568 packet_put_cstring(const char *str)
 569 {
 570         buffer_put_cstring(&outgoing_packet, str);
 571 }
 572
 573 void
 574 packet_put_raw(const void *buf, u_int len)
 575 {
 576         buffer_append(&outgoing_packet, buf, len);
 577 }
 578
 579 void
 580 packet_put_bignum(BIGNUM * value)
 581 {
 582         buffer_put_bignum(&outgoing_packet, value);
 583 }
 584
 585 void
 586 packet_put_bignum2(BIGNUM * value)
 587 {
 588         buffer_put_bignum2(&outgoing_packet, value);
 589 }
 590
 591 /*
 592  * Finalizes and sends the packet.  If the encryption key has been set,
 593  * encrypts the packet before sending.
 594  */
 595
 596 static void
 597 packet_send1(void)
 598 {
 599         u_char buf[8], *cp;
 600         int i, padding, len;
 601         u_int checksum;
 602         u_int32_t rnd = 0;
 603
 604         /*
 605          * If using packet compression, compress the payload of the outgoing
 606          * packet.
 607          */
 608         if (packet_compression) {
 609                 buffer_clear(&compression_buffer);
 610                 /* Skip padding. */
 611                 buffer_consume(&outgoing_packet, 8);
 612                 /* padding */
 613                 buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
 614                 buffer_compress(&outgoing_packet, &compression_buffer);
 615                 buffer_clear(&outgoing_packet);
 616                 buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
 617                     buffer_len(&compression_buffer));
 618         }
 619         /* Compute packet length without padding (add checksum, remove padding). */
 620         len = buffer_len(&outgoing_packet) + 4 - 8;
 621
 622         /* Insert padding. Initialized to zero in packet_start1() */
 623         padding = 8 - len % 8;
 624         if (!send_context.plaintext) {
 625                 cp = buffer_ptr(&outgoing_packet);
 626                 for (i = 0; i < padding; i++) {
 627                         if (i % 4 == 0)
 628                                 rnd = arc4random();
 629                         cp[7 - i] = rnd & 0xff;
 630                         rnd >>= 8;
 631                 }
 632         }
 633         buffer_consume(&outgoing_packet, 8 - padding);
 634
 635         /* Add check bytes. */
 636         checksum = ssh_crc32(buffer_ptr(&outgoing_packet),
 637             buffer_len(&outgoing_packet));
 638         put_u32(buf, checksum);
 639         buffer_append(&outgoing_packet, buf, 4);
 640
 641 #ifdef PACKET_DEBUG
 642         fprintf(stderr, "packet_send plain: ");
 643         buffer_dump(&outgoing_packet);
 644 #endif
 645
 646         /* Append to output. */
 647         put_u32(buf, len);
 648         buffer_append(&output, buf, 4);
 649         cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
 650         cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
 651             buffer_len(&outgoing_packet));
 652
 653 #ifdef PACKET_DEBUG
 654         fprintf(stderr, "encrypted: ");
 655         buffer_dump(&output);
 656 #endif
 657         p_send.packets++;
 658         p_send.bytes += len + buffer_len(&outgoing_packet);
 659         buffer_clear(&outgoing_packet);
 660
 661         /*
 662          * Note that the packet is now only buffered in output.  It won't be
 663          * actually sent until packet_write_wait or packet_write_poll is
 664          * called.
 665          */
 666 }
 667
 668 void
 669 set_newkeys(int mode)
 670 {
 671         Enc *enc;
 672         Mac *mac;
 673         Comp *comp;
 674         CipherContext *cc;
 675         u_int64_t *max_blocks;
 676         int crypt_type;
 677
 678         debug2("set_newkeys: mode %d", mode);
 679
 680         if (mode == MODE_OUT) {
 681                 cc = &send_context;
 682                 crypt_type = CIPHER_ENCRYPT;
 683                 p_send.packets = p_send.blocks = 0;
 684                 max_blocks = &max_blocks_out;
 685         } else {
 686                 cc = &receive_context;
 687                 crypt_type = CIPHER_DECRYPT;
 688                 p_read.packets = p_read.blocks = 0;
 689                 max_blocks = &max_blocks_in;
 690         }
 691         if (newkeys[mode] != NULL) {
 692                 debug("set_newkeys: rekeying");
 693                 cipher_cleanup(cc);
 694                 enc  = &newkeys[mode]->enc;
 695                 mac  = &newkeys[mode]->mac;
 696                 comp = &newkeys[mode]->comp;
 697                 mac_clear(mac);
 698                 xfree(enc->name);
 699                 xfree(enc->iv);
 700                 xfree(enc->key);
 701                 xfree(mac->name);
 702                 xfree(mac->key);
 703                 xfree(comp->name);
 704                 xfree(newkeys[mode]);
 705         }
 706         newkeys[mode] = kex_get_newkeys(mode);
 707         if (newkeys[mode] == NULL)
 708                 fatal("newkeys: no keys for mode %d", mode);
 709         enc  = &newkeys[mode]->enc;
 710         mac  = &newkeys[mode]->mac;
 711         comp = &newkeys[mode]->comp;
 712         if (mac_init(mac) == 0)
 713                 mac->enabled = 1;
 714         DBG(debug("cipher_init_context: %d", mode));
 715         cipher_init(cc, enc->cipher, enc->key, enc->key_len,
 716             enc->iv, enc->block_size, crypt_type);
 717         /* Deleting the keys does not gain extra security */
 718         /* memset(enc->iv,  0, enc->block_size);
 719            memset(enc->key, 0, enc->key_len);
 720            memset(mac->key, 0, mac->key_len); */
 721         if ((comp->type == COMP_ZLIB ||
 722             (comp->type == COMP_DELAYED && after_authentication)) &&
 723             comp->enabled == 0) {
 724                 packet_init_compression();
 725                 if (mode == MODE_OUT)
 726                         buffer_compress_init_send(6);
 727                 else
 728                         buffer_compress_init_recv();
 729                 comp->enabled = 1;
 730         }
 731         /*
 732          * The 2^(blocksize*2) limit is too expensive for 3DES,
 733          * blowfish, etc, so enforce a 1GB limit for small blocksizes.
 734          */
 735         if (enc->block_size >= 16)
 736                 *max_blocks = (u_int64_t)1 << (enc->block_size*2);
 737         else
 738                 *max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
 739         if (rekey_limit)
 740                 *max_blocks = MIN(*max_blocks, rekey_limit / enc->block_size);
 741 }
 742
 743 /*
 744  * Delayed compression for SSH2 is enabled after authentication:
 745  * This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
 746  * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
 747  */
 748 static void
 749 packet_enable_delayed_compress(void)
 750 {
 751         Comp *comp = NULL;
 752         int mode;
 753
 754         /*
 755          * Remember that we are past the authentication step, so rekeying
 756          * with COMP_DELAYED will turn on compression immediately.
 757          */
 758         after_authentication = 1;
 759         for (mode = 0; mode < MODE_MAX; mode++) {
 760                 /* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
 761                 if (newkeys[mode] == NULL)
 762                         continue;
 763                 comp = &newkeys[mode]->comp;
 764                 if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
 765                         packet_init_compression();
 766                         if (mode == MODE_OUT)
 767                                 buffer_compress_init_send(6);
 768                         else
 769                                 buffer_compress_init_recv();
 770                         comp->enabled = 1;
 771                 }
 772         }
 773 }
 774
 775 /*
 776  * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
 777  */
 778 static int
 779 packet_send2_wrapped(void)
 780 {
 781         u_char type, *cp, *macbuf = NULL;
 782         u_char padlen, pad;
 783         u_int packet_length = 0;
 784         u_int i, len;
 785         u_int32_t rnd = 0;
 786         Enc *enc   = NULL;
 787         Mac *mac   = NULL;
 788         Comp *comp = NULL;
 789         int block_size;
 790
 791         if (newkeys[MODE_OUT] != NULL) {
 792                 enc  = &newkeys[MODE_OUT]->enc;
 793                 mac  = &newkeys[MODE_OUT]->mac;
 794                 comp = &newkeys[MODE_OUT]->comp;
 795         }
 796         block_size = enc ? enc->block_size : 8;
 797
 798         cp = buffer_ptr(&outgoing_packet);
 799         type = cp[5];
 800
 801 #ifdef PACKET_DEBUG
 802         fprintf(stderr, "plain:     ");
 803         buffer_dump(&outgoing_packet);
 804 #endif
 805
 806         if (comp && comp->enabled) {
 807                 len = buffer_len(&outgoing_packet);
 808                 /* skip header, compress only payload */
 809                 buffer_consume(&outgoing_packet, 5);
 810                 buffer_clear(&compression_buffer);
 811                 buffer_compress(&outgoing_packet, &compression_buffer);
 812                 buffer_clear(&outgoing_packet);
 813                 buffer_append(&outgoing_packet, "\0\0\0\0\0", 5);
 814                 buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
 815                     buffer_len(&compression_buffer));
 816                 DBG(debug("compression: raw %d compressed %d", len,
 817                     buffer_len(&outgoing_packet)));
 818         }
 819
 820         /* sizeof (packet_len + pad_len + payload) */
 821         len = buffer_len(&outgoing_packet);
 822
 823         /*
 824          * calc size of padding, alloc space, get random data,
 825          * minimum padding is 4 bytes
 826          */
 827         padlen = block_size - (len % block_size);
 828         if (padlen < 4)
 829                 padlen += block_size;
 830         if (extra_pad) {
 831                 /* will wrap if extra_pad+padlen > 255 */
 832                 extra_pad  = roundup(extra_pad, block_size);
 833                 pad = extra_pad - ((len + padlen) % extra_pad);
 834                 debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
 835                     pad, len, padlen, extra_pad);
 836                 padlen += pad;
 837                 extra_pad = 0;
 838         }
 839         cp = buffer_append_space(&outgoing_packet, padlen);
 840         if (enc && !send_context.plaintext) {
 841                 /* random padding */
 842                 for (i = 0; i < padlen; i++) {
 843                         if (i % 4 == 0)
 844                                 rnd = arc4random();
 845                         cp[i] = rnd & 0xff;
 846                         rnd >>= 8;
 847                 }
 848         } else {
 849                 /* clear padding */
 850                 memset(cp, 0, padlen);
 851         }
 852         /* packet_length includes payload, padding and padding length field */
 853         packet_length = buffer_len(&outgoing_packet) - 4;
 854         cp = buffer_ptr(&outgoing_packet);
 855         put_u32(cp, packet_length);
 856         cp[4] = padlen;
 857         DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
 858
 859         /* compute MAC over seqnr and packet(length fields, payload, padding) */
 860         if (mac && mac->enabled) {
 861                 macbuf = mac_compute(mac, p_send.seqnr,
 862                     buffer_ptr(&outgoing_packet),
 863                     buffer_len(&outgoing_packet));
 864                 DBG(debug("done calc MAC out #%d", p_send.seqnr));
 865         }
 866         /* encrypt packet and append to output buffer. */
 867         cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
 868         cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
 869             buffer_len(&outgoing_packet));
 870         /* append unencrypted MAC */
 871         if (mac && mac->enabled)
 872                 buffer_append(&output, macbuf, mac->mac_len);
 873 #ifdef PACKET_DEBUG
 874         fprintf(stderr, "encrypted: ");
 875         buffer_dump(&output);
 876 #endif
 877         /* increment sequence number for outgoing packets */
 878         if (++p_send.seqnr == 0)
 879                 logit("outgoing seqnr wraps around");
 880         if (++p_send.packets == 0)
 881                 if (!(datafellows & SSH_BUG_NOREKEY))
 882                         fatal("XXX too many packets with same key");
 883         p_send.blocks += (packet_length + 4) / block_size;
 884         p_send.bytes += packet_length + 4;
 885         buffer_clear(&outgoing_packet);
 886
 887         if (type == SSH2_MSG_NEWKEYS)
 888                 set_newkeys(MODE_OUT);
 889         else if (type == SSH2_MSG_USERAUTH_SUCCESS && server_side)
 890                 packet_enable_delayed_compress();
 891         return(packet_length);
 892 }
 893
 894 static int
 895 packet_send2(void)
 896 {
 897         static int packet_length = 0;
 898         static int rekeying = 0;
 899         struct packet *p;
 900         u_char type, *cp;
 901
 902         cp = buffer_ptr(&outgoing_packet);
 903         type = cp[5];
 904
 905         /* during rekeying we can only send key exchange messages */
 906         if (rekeying) {
 907                 if (!((type >= SSH2_MSG_TRANSPORT_MIN) &&
 908                     (type <= SSH2_MSG_TRANSPORT_MAX))) {
 909                         debug("enqueue packet: %u", type);
 910                         p = xmalloc(sizeof(*p));
 911                         p->type = type;
 912                         memcpy(&p->payload, &outgoing_packet, sizeof(Buffer));
 913                         buffer_init(&outgoing_packet);
 914                         TAILQ_INSERT_TAIL(&outgoing, p, next);
 915                         return(sizeof(Buffer));
 916                 }
 917         }
 918
 919         /* rekeying starts with sending KEXINIT */
 920         if (type == SSH2_MSG_KEXINIT)
 921                 rekeying = 1;
 922
 923         packet_length = packet_send2_wrapped();
 924
 925         /* after a NEWKEYS message we can send the complete queue */
 926         if (type == SSH2_MSG_NEWKEYS) {
 927                 rekeying = 0;
 928                 while ((p = TAILQ_FIRST(&outgoing))) {
 929                         type = p->type;
 930                         debug("dequeue packet: %u", type);
 931                         buffer_free(&outgoing_packet);
 932                         memcpy(&outgoing_packet, &p->payload,
 933                             sizeof(Buffer));
 934                         TAILQ_REMOVE(&outgoing, p, next);
 935                         xfree(p);
 936                         packet_length += packet_send2_wrapped();
 937                 }
 938         }
 939         return(packet_length);
 940 }
 941
 942 int
 943 packet_send(void)
 944 {
 945   int packet_len = 0;
 946         if (compat20)
 947                 packet_len = packet_send2();
 948         else
 949                 packet_send1();
 950         DBG(debug("packet_send done"));
 951         return(packet_len);
 952 }
 953
 954 /*
 955  * Waits until a packet has been received, and returns its type.  Note that
 956  * no other data is processed until this returns, so this function should not
 957  * be used during the interactive session.
 958  */
 959
 960 int
 961 packet_read_seqnr(u_int32_t *seqnr_p)
 962 {
 963         int type, len, ret, ms_remain;
 964         fd_set *setp;
 965         char buf[8192];
 966         struct timeval timeout, start, *timeoutp = NULL;
 967
 968         DBG(debug("packet_read()"));
 969
 970         setp = (fd_set *)xcalloc(howmany(connection_in+1, NFDBITS),
 971             sizeof(fd_mask));
 972
 973         /* Since we are blocking, ensure that all written packets have been sent. */
 974         packet_write_wait();
 975
 976         /* Stay in the loop until we have received a complete packet. */
 977         for (;;) {
 978                 /* Try to read a packet from the buffer. */
 979                 type = packet_read_poll_seqnr(seqnr_p);
 980                 if (!compat20 && (
 981                     type == SSH_SMSG_SUCCESS
 982                     || type == SSH_SMSG_FAILURE
 983                     || type == SSH_CMSG_EOF
 984                     || type == SSH_CMSG_EXIT_CONFIRMATION))
 985                         packet_check_eom();
 986                 /* If we got a packet, return it. */
 987                 if (type != SSH_MSG_NONE) {
 988                         xfree(setp);
 989                         return type;
 990                 }
 991                 /*
 992                  * Otherwise, wait for some data to arrive, add it to the
 993                  * buffer, and try again.
 994                  */
 995                 memset(setp, 0, howmany(connection_in + 1, NFDBITS) *
 996                     sizeof(fd_mask));
 997                 FD_SET(connection_in, setp);
 998
 999                 if (packet_timeout_ms > 0) {
1000                         ms_remain = packet_timeout_ms;
1001                         timeoutp = &timeout;
1002                 }
1003                 /* Wait for some data to arrive. */
1004                 for (;;) {
1005                         if (packet_timeout_ms != -1) {
1006                                 ms_to_timeval(&timeout, ms_remain);
1007                                 gettimeofday(&start, NULL);
1008                         }
1009                         if ((ret = select(connection_in + 1, setp, NULL,
1010                             NULL, timeoutp)) >= 0)
1011                                 break;
1012                         if (errno != EAGAIN && errno != EINTR &&
1013                             errno != EWOULDBLOCK)
1014                                 break;
1015                         if (packet_timeout_ms == -1)
1016                                 continue;
1017                         ms_subtract_diff(&start, &ms_remain);
1018                         if (ms_remain <= 0) {
1019                                 ret = 0;
1020                                 break;
1021                         }
1022                 }
1023                 if (ret == 0) {
1024                         logit("Connection to %.200s timed out while "
1025                             "waiting to read", get_remote_ipaddr());
1026                         cleanup_exit(255);
1027                 }
1028                 /* Read data from the socket. */
1029                 len = read(connection_in, buf, sizeof(buf));
1030                 if (len == 0) {
1031                         logit("Connection closed by %.200s", get_remote_ipaddr());
1032                         cleanup_exit(255);
1033                 }
1034                 if (len < 0)
1035                         fatal("Read from socket failed: %.100s", strerror(errno));
1036                 /* Append it to the buffer. */
1037                 packet_process_incoming(buf, len);
1038         }
1039         /* NOTREACHED */
1040 }
1041
1042 int
1043 packet_read(void)
1044 {
1045         return packet_read_seqnr(NULL);
1046 }
1047
1048 /*
1049  * Waits until a packet has been received, verifies that its type matches
1050  * that given, and gives a fatal error and exits if there is a mismatch.
1051  */
1052
1053 void
1054 packet_read_expect(int expected_type)
1055 {
1056         int type;
1057
1058         type = packet_read();
1059         if (type != expected_type)
1060                 packet_disconnect("Protocol error: expected packet type %d, got %d",
1061                     expected_type, type);
1062 }
1063
1064 /* Checks if a full packet is available in the data received so far via
1065  * packet_process_incoming.  If so, reads the packet; otherwise returns
1066  * SSH_MSG_NONE.  This does not wait for data from the connection.
1067  *
1068  * SSH_MSG_DISCONNECT is handled specially here.  Also,
1069  * SSH_MSG_IGNORE messages are skipped by this function and are never returned
1070  * to higher levels.
1071  */
1072
1073 static int
1074 packet_read_poll1(void)
1075 {
1076         u_int len, padded_len;
1077         u_char *cp, type;
1078         u_int checksum, stored_checksum;
1079
1080         /* Check if input size is less than minimum packet size. */
1081         if (buffer_len(&input) < 4 + 8)
1082                 return SSH_MSG_NONE;
1083         /* Get length of incoming packet. */
1084         cp = buffer_ptr(&input);
1085         len = get_u32(cp);
1086         if (len < 1 + 2 + 2 || len > 256 * 1024)
1087                 packet_disconnect("Bad packet length %u.", len);
1088         padded_len = (len + 8) & ~7;
1089
1090         /* Check if the packet has been entirely received. */
1091         if (buffer_len(&input) < 4 + padded_len)
1092                 return SSH_MSG_NONE;
1093
1094         /* The entire packet is in buffer. */
1095
1096         /* Consume packet length. */
1097         buffer_consume(&input, 4);
1098
1099         /*
1100          * Cryptographic attack detector for ssh
1101          * (C)1998 CORE-SDI, Buenos Aires Argentina
1102          * Ariel Futoransky(futo@core-sdi.com)
1103          */
1104         if (!receive_context.plaintext) {
1105                 switch (detect_attack(buffer_ptr(&input), padded_len)) {
1106                 case DEATTACK_DETECTED:
1107                         packet_disconnect("crc32 compensation attack: "
1108                             "network attack detected");
1109                 case DEATTACK_DOS_DETECTED:
1110                         packet_disconnect("deattack denial of "
1111                             "service detected");
1112                 }
1113         }
1114
1115         /* Decrypt data to incoming_packet. */
1116         buffer_clear(&incoming_packet);
1117         cp = buffer_append_space(&incoming_packet, padded_len);
1118         cipher_crypt(&receive_context, cp, buffer_ptr(&input), padded_len);
1119
1120         buffer_consume(&input, padded_len);
1121
1122 #ifdef PACKET_DEBUG
1123         fprintf(stderr, "read_poll plain: ");
1124         buffer_dump(&incoming_packet);
1125 #endif
1126
1127         /* Compute packet checksum. */
1128         checksum = ssh_crc32(buffer_ptr(&incoming_packet),
1129             buffer_len(&incoming_packet) - 4);
1130
1131         /* Skip padding. */
1132         buffer_consume(&incoming_packet, 8 - len % 8);
1133
1134         /* Test check bytes. */
1135         if (len != buffer_len(&incoming_packet))
1136                 packet_disconnect("packet_read_poll1: len %d != buffer_len %d.",
1137                     len, buffer_len(&incoming_packet));
1138
1139         cp = (u_char *)buffer_ptr(&incoming_packet) + len - 4;
1140         stored_checksum = get_u32(cp);
1141         if (checksum != stored_checksum)
1142                 packet_disconnect("Corrupted check bytes on input.");
1143         buffer_consume_end(&incoming_packet, 4);
1144
1145         if (packet_compression) {
1146                 buffer_clear(&compression_buffer);
1147                 buffer_uncompress(&incoming_packet, &compression_buffer);
1148                 buffer_clear(&incoming_packet);
1149                 buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
1150                     buffer_len(&compression_buffer));
1151         }
1152         p_read.packets++;
1153         p_read.bytes += padded_len + 4;
1154         type = buffer_get_char(&incoming_packet);
1155         if (type < SSH_MSG_MIN || type > SSH_MSG_MAX)
1156                 packet_disconnect("Invalid ssh1 packet type: %d", type);
1157         return type;
1158 }
1159
1160 static int
1161 packet_read_poll2(u_int32_t *seqnr_p)
1162 {
1163         static u_int packet_length = 0;
1164         u_int padlen, need;
1165         u_char *macbuf, *cp, type;
1166         u_int maclen, block_size;
1167         Enc *enc   = NULL;
1168         Mac *mac   = NULL;
1169         Comp *comp = NULL;
1170
1171         if (packet_discard)
1172                 return SSH_MSG_NONE;
1173
1174         if (newkeys[MODE_IN] != NULL) {
1175                 enc  = &newkeys[MODE_IN]->enc;
1176                 mac  = &newkeys[MODE_IN]->mac;
1177                 comp = &newkeys[MODE_IN]->comp;
1178         }
1179         maclen = mac && mac->enabled ? mac->mac_len : 0;
1180         block_size = enc ? enc->block_size : 8;
1181
1182         if (packet_length == 0) {
1183                 /*
1184                  * check if input size is less than the cipher block size,
1185                  * decrypt first block and extract length of incoming packet
1186                  */
1187                 if (buffer_len(&input) < block_size)
1188                         return SSH_MSG_NONE;
1189                 buffer_clear(&incoming_packet);
1190                 cp = buffer_append_space(&incoming_packet, block_size);
1191                 cipher_crypt(&receive_context, cp, buffer_ptr(&input),
1192                     block_size);
1193                 cp = buffer_ptr(&incoming_packet);
1194                 packet_length = get_u32(cp);
1195                 if (packet_length < 1 + 4 || packet_length > PACKET_MAX_SIZE) {
1196 #ifdef PACKET_DEBUG
1197                         buffer_dump(&incoming_packet);
1198 #endif
1199                         logit("Bad packet length %u.", packet_length);
1200                         packet_start_discard(enc, mac, packet_length,
1201                             PACKET_MAX_SIZE);
1202                         return SSH_MSG_NONE;
1203                 }
1204                 DBG(debug("input: packet len %u", packet_length+4));
1205                 buffer_consume(&input, block_size);
1206         }
1207         /* we have a partial packet of block_size bytes */
1208         need = 4 + packet_length - block_size;
1209         DBG(debug("partial packet %d, need %d, maclen %d", block_size,
1210             need, maclen));
1211         if (need % block_size != 0) {
1212                 logit("padding error: need %d block %d mod %d",
1213                     need, block_size, need % block_size);
1214                 packet_start_discard(enc, mac, packet_length,
1215                     PACKET_MAX_SIZE - block_size);
1216                 return SSH_MSG_NONE;
1217         }
1218         /*
1219          * check if the entire packet has been received and
1220          * decrypt into incoming_packet
1221          */
1222         if (buffer_len(&input) < need + maclen)
1223                 return SSH_MSG_NONE;
1224 #ifdef PACKET_DEBUG
1225         fprintf(stderr, "read_poll enc/full: ");
1226         buffer_dump(&input);
1227 #endif
1228         cp = buffer_append_space(&incoming_packet, need);
1229         cipher_crypt(&receive_context, cp, buffer_ptr(&input), need);
1230         buffer_consume(&input, need);
1231         /*
1232          * compute MAC over seqnr and packet,
1233          * increment sequence number for incoming packet
1234          */
1235         if (mac && mac->enabled) {
1236                 macbuf = mac_compute(mac, p_read.seqnr,
1237                     buffer_ptr(&incoming_packet),
1238                     buffer_len(&incoming_packet));
1239                 if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0) {
1240                         logit("Corrupted MAC on input.");
1241                         if (need > PACKET_MAX_SIZE)
1242                                 fatal("internal error need %d", need);
1243                         packet_start_discard(enc, mac, packet_length,
1244                             PACKET_MAX_SIZE - need);
1245                         return SSH_MSG_NONE;
1246                 }
1247
1248                 DBG(debug("MAC #%d ok", p_read.seqnr));
1249                 buffer_consume(&input, mac->mac_len);
1250         }
1251         /* XXX now it's safe to use fatal/packet_disconnect */
1252         if (seqnr_p != NULL)
1253                 *seqnr_p = p_read.seqnr;
1254         if (++p_read.seqnr == 0)
1255                 logit("incoming seqnr wraps around");
1256         if (++p_read.packets == 0)
1257                 if (!(datafellows & SSH_BUG_NOREKEY))
1258                         fatal("XXX too many packets with same key");
1259         p_read.blocks += (packet_length + 4) / block_size;
1260         p_read.bytes += packet_length + 4;
1261
1262         /* get padlen */
1263         cp = buffer_ptr(&incoming_packet);
1264         padlen = cp[4];
1265         DBG(debug("input: padlen %d", padlen));
1266         if (padlen < 4)
1267                 packet_disconnect("Corrupted padlen %d on input.", padlen);
1268
1269         /* skip packet size + padlen, discard padding */
1270         buffer_consume(&incoming_packet, 4 + 1);
1271         buffer_consume_end(&incoming_packet, padlen);
1272
1273         DBG(debug("input: len before de-compress %d", buffer_len(&incoming_packet)));
1274         if (comp && comp->enabled) {
1275                 buffer_clear(&compression_buffer);
1276                 buffer_uncompress(&incoming_packet, &compression_buffer);
1277                 buffer_clear(&incoming_packet);
1278                 buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
1279                     buffer_len(&compression_buffer));
1280                 DBG(debug("input: len after de-compress %d",
1281                     buffer_len(&incoming_packet)));
1282         }
1283         /*
1284          * get packet type, implies consume.
1285          * return length of payload (without type field)
1286          */
1287         type = buffer_get_char(&incoming_packet);
1288         if (type < SSH2_MSG_MIN || type >= SSH2_MSG_LOCAL_MIN)
1289                 packet_disconnect("Invalid ssh2 packet type: %d", type);
1290         if (type == SSH2_MSG_NEWKEYS)
1291                 set_newkeys(MODE_IN);
1292         else if (type == SSH2_MSG_USERAUTH_SUCCESS && !server_side)
1293                 packet_enable_delayed_compress();
1294 #ifdef PACKET_DEBUG
1295         fprintf(stderr, "read/plain[%d]:\r\n", type);
1296         buffer_dump(&incoming_packet);
1297 #endif
1298         /* reset for next packet */
1299         packet_length = 0;
1300         return type;
1301 }
1302
1303 int
1304 packet_read_poll_seqnr(u_int32_t *seqnr_p)
1305 {
1306         u_int reason, seqnr;
1307         u_char type;
1308         char *msg;
1309
1310         for (;;) {
1311                 if (compat20) {
1312                         type = packet_read_poll2(seqnr_p);
1313                         if (type) {
1314                                 keep_alive_timeouts = 0;
1315                                 DBG(debug("received packet type %d", type));
1316                         }
1317                         switch (type) {
1318                         case SSH2_MSG_IGNORE:
1319                                 debug3("Received SSH2_MSG_IGNORE");
1320                                 break;
1321                         case SSH2_MSG_DEBUG:
1322                                 packet_get_char();
1323                                 msg = packet_get_string(NULL);
1324                                 debug("Remote: %.900s", msg);
1325                                 xfree(msg);
1326                                 msg = packet_get_string(NULL);
1327                                 xfree(msg);
1328                                 break;
1329                         case SSH2_MSG_DISCONNECT:
1330                                 reason = packet_get_int();
1331                                 msg = packet_get_string(NULL);
1332                                 logit("Received disconnect from %s: %u: %.400s",
1333                                     get_remote_ipaddr(), reason, msg);
1334                                 xfree(msg);
1335                                 cleanup_exit(255);
1336                                 break;
1337                         case SSH2_MSG_UNIMPLEMENTED:
1338                                 seqnr = packet_get_int();
1339                                 debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
1340                                     seqnr);
1341                                 break;
1342                         default:
1343                                 return type;
1344                         }
1345                 } else {
1346                         type = packet_read_poll1();
1347                         switch (type) {
1348                         case SSH_MSG_IGNORE:
1349                                 break;
1350                         case SSH_MSG_DEBUG:
1351                                 msg = packet_get_string(NULL);
1352                                 debug("Remote: %.900s", msg);
1353                                 xfree(msg);
1354                                 break;
1355                         case SSH_MSG_DISCONNECT:
1356                                 msg = packet_get_string(NULL);
1357                                 logit("Received disconnect from %s: %.400s",
1358                                     get_remote_ipaddr(), msg);
1359                                 cleanup_exit(255);
1360                                 break;
1361                         default:
1362                                 if (type)
1363                                         DBG(debug("received packet type %d", type));
1364                                 return type;
1365                         }
1366                 }
1367         }
1368 }
1369
1370 int
1371 packet_read_poll(void)
1372 {
1373         return packet_read_poll_seqnr(NULL);
1374 }
1375
1376 /*
1377  * Buffers the given amount of input characters.  This is intended to be used
1378  * together with packet_read_poll.
1379  */
1380
1381 void
1382 packet_process_incoming(const char *buf, u_int len)
1383 {
1384         if (packet_discard) {
1385                 keep_alive_timeouts = 0; /* ?? */
1386                 if (len >= packet_discard)
1387                         packet_stop_discard();
1388                 packet_discard -= len;
1389                 return;
1390         }
1391         buffer_append(&input, buf, len);
1392 }
1393
1394 /* Returns a character from the packet. */
1395
1396 u_int
1397 packet_get_char(void)
1398 {
1399         char ch;
1400
1401         buffer_get(&incoming_packet, &ch, 1);
1402         return (u_char) ch;
1403 }
1404
1405 /* Returns an integer from the packet data. */
1406
1407 u_int
1408 packet_get_int(void)
1409 {
1410         return buffer_get_int(&incoming_packet);
1411 }
1412
1413 /*
1414  * Returns an arbitrary precision integer from the packet data.  The integer
1415  * must have been initialized before this call.
1416  */
1417
1418 void
1419 packet_get_bignum(BIGNUM * value)
1420 {
1421         buffer_get_bignum(&incoming_packet, value);
1422 }
1423
1424 void
1425 packet_get_bignum2(BIGNUM * value)
1426 {
1427         buffer_get_bignum2(&incoming_packet, value);
1428 }
1429
1430 void *
1431 packet_get_raw(u_int *length_ptr)
1432 {
1433         u_int bytes = buffer_len(&incoming_packet);
1434
1435         if (length_ptr != NULL)
1436                 *length_ptr = bytes;
1437         return buffer_ptr(&incoming_packet);
1438 }
1439
1440 int
1441 packet_remaining(void)
1442 {
1443         return buffer_len(&incoming_packet);
1444 }
1445
1446 /*
1447  * Returns a string from the packet data.  The string is allocated using
1448  * xmalloc; it is the responsibility of the calling program to free it when
1449  * no longer needed.  The length_ptr argument may be NULL, or point to an
1450  * integer into which the length of the string is stored.
1451  */
1452
1453 void *
1454 packet_get_string(u_int *length_ptr)
1455 {
1456         return buffer_get_string(&incoming_packet, length_ptr);
1457 }
1458
1459 void *
1460 packet_get_string_ptr(u_int *length_ptr)
1461 {
1462         return buffer_get_string_ptr(&incoming_packet, length_ptr);
1463 }
1464
1465 /*
1466  * Sends a diagnostic message from the server to the client.  This message
1467  * can be sent at any time (but not while constructing another message). The
1468  * message is printed immediately, but only if the client is being executed
1469  * in verbose mode.  These messages are primarily intended to ease debugging
1470  * authentication problems.   The length of the formatted message must not
1471  * exceed 1024 bytes.  This will automatically call packet_write_wait.
1472  */
1473
1474 void
1475 packet_send_debug(const char *fmt,...)
1476 {
1477         char buf[1024];
1478         va_list args;
1479
1480         if (compat20 && (datafellows & SSH_BUG_DEBUG))
1481                 return;
1482
1483         va_start(args, fmt);
1484         vsnprintf(buf, sizeof(buf), fmt, args);
1485         va_end(args);
1486
1487         if (compat20) {
1488                 packet_start(SSH2_MSG_DEBUG);
1489                 packet_put_char(0);     /* bool: always display */
1490                 packet_put_cstring(buf);
1491                 packet_put_cstring("");
1492         } else {
1493                 packet_start(SSH_MSG_DEBUG);
1494                 packet_put_cstring(buf);
1495         }
1496         packet_send();
1497         packet_write_wait();
1498 }
1499
1500 /*
1501  * Logs the error plus constructs and sends a disconnect packet, closes the
1502  * connection, and exits.  This function never returns. The error message
1503  * should not contain a newline.  The length of the formatted message must
1504  * not exceed 1024 bytes.
1505  */
1506
1507 void
1508 packet_disconnect(const char *fmt,...)
1509 {
1510         char buf[1024];
1511         va_list args;
1512         static int disconnecting = 0;
1513
1514         if (disconnecting)      /* Guard against recursive invocations. */
1515                 fatal("packet_disconnect called recursively.");
1516         disconnecting = 1;
1517
1518         /*
1519          * Format the message.  Note that the caller must make sure the
1520          * message is of limited size.
1521          */
1522         va_start(args, fmt);
1523         vsnprintf(buf, sizeof(buf), fmt, args);
1524         va_end(args);
1525
1526         /* Display the error locally */
1527         logit("Disconnecting: %.100s", buf);
1528
1529         /* Send the disconnect message to the other side, and wait for it to get sent. */
1530         if (compat20) {
1531                 packet_start(SSH2_MSG_DISCONNECT);
1532                 packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR);
1533                 packet_put_cstring(buf);
1534                 packet_put_cstring("");
1535         } else {
1536                 packet_start(SSH_MSG_DISCONNECT);
1537                 packet_put_cstring(buf);
1538         }
1539         packet_send();
1540         packet_write_wait();
1541
1542         /* Stop listening for connections. */
1543         channel_close_all();
1544
1545         /* Close the connection. */
1546         packet_close();
1547         cleanup_exit(255);
1548 }
1549
1550 /* Checks if there is any buffered output, and tries to write some of the output. */
1551
1552 int
1553 packet_write_poll(void)
1554 {
1555         int len = 0;
1556         len = buffer_len(&output);
1557
1558         if (len > 0) {
1559                 len = write(connection_out, buffer_ptr(&output), len);
1560                 if (len == -1) {
1561                         if (errno == EINTR || errno == EAGAIN ||
1562                             errno == EWOULDBLOCK)
1563                                 return (0);
1564                         fatal("Write failed: %.100s", strerror(errno));
1565                 }
1566                 if (len == 0)
1567                         fatal("Write connection closed");
1568                 buffer_consume(&output, len);
1569         }
1570         return(len);
1571 }
1572
1573
1574 /*
1575  * Calls packet_write_poll repeatedly until all pending output data has been
1576  * written.
1577  */
1578
1579 int
1580 packet_write_wait(void)
1581 {
1582         fd_set *setp;
1583         int ret, ms_remain;
1584         struct timeval start, timeout, *timeoutp = NULL;
1585         u_int bytes_sent = 0;
1586
1587         setp = (fd_set *)xcalloc(howmany(connection_out + 1, NFDBITS),
1588             sizeof(fd_mask));
1589         bytes_sent += packet_write_poll();
1590         while (packet_have_data_to_write()) {
1591                 memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
1592                     sizeof(fd_mask));
1593                 FD_SET(connection_out, setp);
1594
1595                 if (packet_timeout_ms > 0) {
1596                         ms_remain = packet_timeout_ms;
1597                         timeoutp = &timeout;
1598                 }
1599                 for (;;) {
1600                         if (packet_timeout_ms != -1) {
1601                                 ms_to_timeval(&timeout, ms_remain);
1602                                 gettimeofday(&start, NULL);
1603                         }
1604                         if ((ret = select(connection_out + 1, NULL, setp,
1605                             NULL, timeoutp)) >= 0)
1606                                 break;
1607                         if (errno != EAGAIN && errno != EINTR &&
1608                             errno != EWOULDBLOCK)
1609                                 break;
1610                         if (packet_timeout_ms == -1)
1611                                 continue;
1612                         ms_subtract_diff(&start, &ms_remain);
1613                         if (ms_remain <= 0) {
1614                                 ret = 0;
1615                                 break;
1616                         }
1617                 }
1618                 if (ret == 0) {
1619                         logit("Connection to %.200s timed out while "
1620                             "waiting to write", get_remote_ipaddr());
1621                         cleanup_exit(255);
1622                 }
1623                 bytes_sent += packet_write_poll();
1624         }
1625         xfree(setp);
1626 }
1627
1628 /* Returns true if there is buffered data to write to the connection. */
1629
1630 int
1631 packet_have_data_to_write(void)
1632 {
1633         return buffer_len(&output) != 0;
1634 }
1635
1636 /* Returns true if there is not too much data to write to the connection. */
1637
1638 int
1639 packet_not_very_much_data_to_write(void)
1640 {
1641         if (interactive_mode)
1642                 return buffer_len(&output) < 16384;
1643         else
1644                 return buffer_len(&output) < 128 * 1024;
1645 }
1646
1647
1648 static void
1649 packet_set_tos(int interactive)
1650 {
1651 #if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
1652         int tos = interactive ? IPTOS_LOWDELAY : IPTOS_THROUGHPUT;
1653
1654         if (!packet_connection_is_on_socket() ||
1655             !packet_connection_is_ipv4())
1656                 return;
1657         if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, &tos,
1658             sizeof(tos)) < 0)
1659                 error("setsockopt IP_TOS %d: %.100s:",
1660                     tos, strerror(errno));
1661 #endif
1662 }
1663
1664 /* Informs that the current session is interactive.  Sets IP flags for that. */
1665
1666 void
1667 packet_set_interactive(int interactive)
1668 {
1669         static int called = 0;
1670
1671         if (called)
1672                 return;
1673         called = 1;
1674
1675         /* Record that we are in interactive mode. */
1676         interactive_mode = interactive;
1677
1678         /* Only set socket options if using a socket.  */
1679         if (!packet_connection_is_on_socket())
1680                 return;
1681         set_nodelay(connection_in);
1682         packet_set_tos(interactive);
1683 }
1684
1685 /* Returns true if the current connection is interactive. */
1686
1687 int
1688 packet_is_interactive(void)
1689 {
1690         return interactive_mode;
1691 }
1692
1693 int
1694 packet_set_maxsize(u_int s)
1695 {
1696         static int called = 0;
1697
1698         if (called) {
1699                 logit("packet_set_maxsize: called twice: old %d new %d",
1700                     max_packet_size, s);
1701                 return -1;
1702         }
1703         if (s < 4 * 1024 || s > 1024 * 1024) {
1704                 logit("packet_set_maxsize: bad size %d", s);
1705                 return -1;
1706         }
1707         called = 1;
1708         debug("packet_set_maxsize: setting to %d", s);
1709         max_packet_size = s;
1710         return s;
1711 }
1712
1713 /* roundup current message to pad bytes */
1714 void
1715 packet_add_padding(u_char pad)
1716 {
1717         extra_pad = pad;
1718 }
1719
1720 /*
1721  * 9.2.  Ignored Data Message
1722  *
1723  *   byte      SSH_MSG_IGNORE
1724  *   string    data
1725  *
1726  * All implementations MUST understand (and ignore) this message at any
1727  * time (after receiving the protocol version). No implementation is
1728  * required to send them. This message can be used as an additional
1729  * protection measure against advanced traffic analysis techniques.
1730  */
1731 void
1732 packet_send_ignore(int nbytes)
1733 {
1734         u_int32_t rnd = 0;
1735         int i;
1736
1737         packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
1738         packet_put_int(nbytes);
1739         for (i = 0; i < nbytes; i++) {
1740                 if (i % 4 == 0)
1741                         rnd = arc4random();
1742                 packet_put_char((u_char)rnd & 0xff);
1743                 rnd >>= 8;
1744         }
1745 }
1746
1747 int rekey_requested = 0;
1748 void
1749 packet_request_rekeying(void)
1750 {
1751         rekey_requested = 1;
1752 }
1753
1754 #define MAX_PACKETS     (1U<<31)
1755 int
1756 packet_need_rekeying(void)
1757 {
1758         if (datafellows & SSH_BUG_NOREKEY)
1759                 return 0;
1760         if (rekey_requested == 1)
1761         {
1762                 rekey_requested = 0;
1763                 return 1;
1764         }
1765         return
1766             (p_send.packets > MAX_PACKETS) ||
1767             (p_read.packets > MAX_PACKETS) ||
1768             (max_blocks_out && (p_send.blocks > max_blocks_out)) ||
1769             (max_blocks_in  && (p_read.blocks > max_blocks_in));
1770 }
1771
1772 void
1773 packet_set_rekey_limit(u_int32_t bytes)
1774 {
1775         rekey_limit = bytes;
1776 }
1777
1778 void
1779 packet_set_server(void)
1780 {
1781         server_side = 1;
1782 }
1783
1784 void
1785 packet_set_authenticated(void)
1786 {
1787         after_authentication = 1;
1788 }
1789
1790 int
1791 packet_authentication_state(void)
1792 {
1793         return(after_authentication);
1794 }